CVE-2026-80715 Overview
CVE-2026-80715 is a Linux kernel vulnerability in the igc Intel Ethernet driver. The flaw occurs when an AF_XDP zero-copy application is killed abruptly. The XSK pool is torn down while NAPI continues polling, causing igc_clean_rx_irq_zc() to return the full budget on every poll. As a result, napi_complete_done() never clears NAPI_STATE_SCHED, and igc_down() spins forever in napi_synchronize() waiting for that bit. The network interface never goes down, producing a denial-of-service condition on the affected host.
Critical Impact
A local process using AF_XDP zero-copy can trigger an indefinite hang in the igc driver during interface teardown, blocking network administration operations.
Affected Products
- Linux kernel branches shipping the igc driver with AF_XDP zero-copy support
- Systems using Intel I225/I226 2.5GbE NICs driven by igc
- Distributions tracking mainline Linux prior to the referenced stable backports
Discovery Timeline
- 2026-08-28 - CVE-2026-80715 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80715
Vulnerability Analysis
The defect lives in the receive-path teardown logic of the Intel igc driver. AF_XDP is a Linux socket family designed for high-performance packet I/O, and its zero-copy mode maps NIC receive descriptors directly into an XSK (XDP socket) memory pool. When the userspace application owning the XSK pool exits without a clean shutdown, the pool is released while the driver's NAPI context is still scheduled.
Under that condition, igc_clean_rx_irq_zc() cannot make forward progress and reports that it consumed the entire NAPI budget. The NAPI core interprets a full-budget return as a signal to keep the poller scheduled, so napi_complete_done() is never called and NAPI_STATE_SCHED remains set. The subsequent call chain in igc_down() invokes napi_synchronize(), which busy-waits until NAPI_STATE_SCHED clears. Because the flag can never clear on its own, the CPU spins indefinitely.
Root Cause
The root cause is an ordering and synchronization defect between XSK pool teardown and NAPI lifecycle management. napi_synchronize() is used where napi_disable() alone is sufficient. napi_disable() sets NAPI_STATE_DISABLE, which forces a stuck poller to complete, whereas napi_synchronize() only waits and never forces exit.
Attack Vector
Exploitation requires local code execution capable of opening an AF_XDP socket in zero-copy mode against an igc-managed interface, then terminating abruptly. Any subsequent ip link set dev <if> down, driver unload, or reset operation will hang. The impact is limited to availability of the network stack and administrative operations on the affected host; there is no memory-safety or privilege-escalation component.
The upstream fix removes the napi_synchronize() call in igc_down(), allowing napi_disable() to force the stuck poll to complete. The change is reordered ahead of igc_set_queue_napi() so the NAPI mapping is cleared only after polling stops, mirroring the earlier igb fix in commit b1e067240379. See the stable kernel commits 3b5aee6, 5ffab5b, 605585a, 9a2b637, a0f16c3, ad6e0df, and f929a6fe for the exact source changes.
Detection Methods for CVE-2026-80715
Indicators of Compromise
- Kernel soft-lockup or hung_task warnings referencing napi_synchronize and igc_down in dmesg.
- An igc interface stuck in UP state after ip link set down returns no error but never completes.
- A CPU pinned at 100% in kernel context tied to an igc receive queue's NAPI thread.
Detection Strategies
- Monitor kernel logs for stack traces containing igc_clean_rx_irq_zc alongside napi_synchronize on Intel I225/I226 hosts.
- Correlate abrupt termination of AF_XDP zero-copy processes (for example, DPDK-XDP, XSK-based load balancers) with subsequent link-down failures.
- Use bpftrace or perf to identify long-running NAPI polls that never invoke napi_complete_done().
Monitoring Recommendations
- Track running kernel version against the fixed stable branches referenced in the kernel.org commits.
- Alert on hung_task_timeout_secs events on hosts that run XDP/AF_XDP workloads.
- Inventory hosts using the igc driver via ethtool -i <if> and prioritize them for patch validation.
How to Mitigate CVE-2026-80715
Immediate Actions Required
- Update to a Linux kernel version that includes the fix referenced in the stable kernel commits listed above.
- Restrict CAP_NET_ADMIN and AF_XDP socket creation to trusted workloads on affected hosts.
- Where practical, avoid abrupt SIGKILL termination of AF_XDP zero-copy applications and use graceful shutdown paths that unbind the XSK pool.
Patch Information
The upstream resolution removes napi_synchronize() from igc_down() and reorders the teardown so napi_disable() handles the stuck poll before igc_set_queue_napi() clears the NAPI mapping. Apply vendor kernels that incorporate any of the referenced commits. Distribution maintainers backported the change across multiple stable series; verify the running kernel with uname -r and validate against the distribution's security advisory.
Workarounds
- Switch AF_XDP consumers from zero-copy (XDP_ZEROCOPY) to copy mode (XDP_COPY) until the kernel is patched.
- Avoid unloading the igc driver or toggling link state on production hosts running unpatched kernels with active AF_XDP workloads.
- Isolate AF_XDP-capable applications inside dedicated namespaces or systemd units so a crash does not require host-wide interface teardown.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.